Offline Backup Verification
This guide defines the offline backup rotation strategy and periodic verification process, ensuring recovery media remains viable and untouched by ransomware that may have compromised online backup systems. Under IACS UR E26 §4.5.2, the vessel must maintain verified offline backup capability for all Category II and III CBS — and must demonstrate to Class that backups have been tested and work.
An offline backup is only truly offline if it requires a human to physically walk to a cabinet and plug it in. In maritime OT security, this air gap is the only absolute guarantee against ransomware that specifically targets backup servers and mapped drives. A backup that is always connected is not a backup — it is a second copy of the infected data.
The three-tier storage protocol
To meet UR E26 §4.5.2, recovery media must be managed in three tiers. The key principle: at any given moment, at least one complete backup must be physically disconnected and locked away — untouchable by any active threat on the network.
The 7-day rotation schedule
The rotation ensures that at any point of compromise, you have a clean backup from at most 7 days ago that was already physically disconnected before the attack started. This is the minimum rotation frequency for Cat II and III systems.
synced & locked
offline
offline
synced & locked
offline
offline
synced & locked
Two drives rotate on alternating sync days. When Drive A is synced on Monday, Drive B remains locked in the safe from its last sync on Thursday. If the vessel is hit on Wednesday, Drive B — last synced Thursday and disconnected ever since — is clean.
Backup integrity verification — before locking away
Every sync must be verified before the drive is locked in the safe. A backup that was not verified may be corrupt, incomplete, or already infected.
The restoration drill — quarterly
A backup that has never been tested does not exist as a recovery asset. Perform a restoration drill every quarter — before the annual survey, not after. Class surveyors may ask to see the drill log.
- Select a non-essential workstation — Office PC or administrative workstation. Never drill on a Category II or III CBS while the vessel is at sea — use port calls or dry dock periods for higher-tier system drills.
- Isolate completely — Disconnect the target workstation from the vessel network before beginning. Confirm it cannot reach any network resource during the drill.
- Wipe and restore from offline media — Apply the Golden Image from the offline backup drive using the exact procedure in the SCSRP. The drill must replicate what would happen in a real incident — not a shortcut version.
- Verify function — Confirm the OS boots cleanly, all required drivers load, OT application launches, and the system clock syncs correctly to NTP.
- Record the result — Log in the Backup Verification Log: date, system used, time to restore, issues encountered, pass or fail. Submit to DPA for SMS filing.
What to do when verification fails
A failed verification is a warning that prevented a crisis — not a crisis itself. Respond immediately.
Physical chain of custody
Recovery media is a target for physical tampering as well as cyber attack. Class surveyors look for evidence of controlled access and proper labelling.
Compliance audit response
“How do you know your backups are not infected?” — “We use a 7-day rotation with two drives alternating. At any point, one drive has been physically disconnected for at least 3 days — longer than our standard incident detection window. We verify file integrity and spot-check readability before locking the drive away after each sync. The last quarterly restoration drill log is in the SMS records.”
This answer demonstrates a functioning backup programme — not just the existence of backup drives. Class surveyors look for evidence of process, not just hardware.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
